Two Passwords, One Surprising Winner
Take two passwords. The first is "Tr0ub4dor&3", nine characters, upper and lower case, a digit, and a symbol: the kind of password a strict-looking policy loves. The second is "correct horse battery staple", four ordinary lowercase words strung together with spaces, easy to say out loud and easy to remember. Most people's gut reaction is that the first one is stronger, because it looks more chaotic. The math says the opposite, and the gap is not small.
"Tr0ub4dor&3" draws from a character set of roughly 94 printable symbols across 9 positions. Using the standard formula for a genuinely random password, bits of entropy equal length multiplied by log2 of the character set size, that works out to about 9 times 6.6, or roughly 59 bits. "Correct horse battery staple," picking 4 words at random from a list of about 7,776 common words (the size of the well known EFF word list), works out to 4 times log2(7776), or roughly 4 times 12.9, about 51 bits by word count alone, but because it is also longer in characters and the word choice is genuinely random, real-world estimates of this exact phrase (popularized by the webcomic xkcd) put it noticeably higher than the short symbol password once you account for how predictable "leetspeak" substitutions like 0 for o and 4 for a actually are to modern cracking tools. The practical lesson holds either way: length assembled from real randomness consistently outperforms a short string of forced complexity, and the passphrase is dramatically easier for a human to actually remember and type correctly.
What Entropy Actually Measures
Entropy, in the password sense, is a count of how many bits of genuine unpredictability a password contains. It is expressed in bits because each additional bit of entropy doubles the number of guesses an attacker must try, on average, before finding the right one. The formula behind it is simple:
bits of entropy = length × log2(size of the character set)
Two variables control the result, and they do not contribute equally:
- Character set size sets the bits earned per character. Lowercase letters only (26 options) contribute about 4.7 bits each. Add uppercase, digits, and symbols (94 options total) and each character is worth about 6.6 bits.
- Length multiplies that per-character value across the whole password, which is why it dominates the total. Going from 8 to 16 characters does not add a little strength, it roughly squares the total number of possible combinations.
Doing the Brute-Force Math
Entropy only means something once you connect it to how fast a real attacker can guess. A modern consumer GPU rig can attempt roughly 10 billion guesses per second against a fast, unsalted hash; a properly salted, deliberately slow hash like bcrypt or Argon2 (see our guide to salting) can push that down to a few thousand guesses per second instead. Using the faster, worst-case number of 10 billion guesses per second against an offline stolen database:
| Entropy | Total combinations | Time to exhaust at 10B/sec |
|---|---|---|
| 40 bits | ~1 trillion | under 2 minutes |
| 52 bits (8 random chars) | ~4.5 quadrillion | about 5 days |
| 79 bits (12 random chars) | ~6 x 1023 | about 1.9 million years |
| 105 bits (16 random chars) | ~4 x 1031 | longer than the age of the universe, many times over |
These numbers assume worst-case offline cracking against a stolen hash database. Online login attempts are a different, much slower threat model entirely, since a well-built site rate-limits and locks out repeated failed logins long before billions of guesses are possible, which is one reason 2FA matters more for everyday account safety than chasing extreme entropy alone.
The Catch: The Formula Assumes Real Randomness
Here is where most people's actual passwords quietly fail. The entropy formula assumes every character was chosen with equal, genuine randomness. Human-created passwords almost never are. "Summer2026!" scores around 70 bits by naive character-set math, but its real, effective entropy is far lower, because cracking tools do not try every combination blindly. They try capitalized dictionary words first, then a year, then a common trailing symbol, in that exact order, because that is how people actually build passwords. The formula cannot see your habits; a cracking tool that has processed millions of leaked passwords absolutely can.
This is the single most important idea in this entire topic: predictability destroys real entropy no matter what the character-count formula says. A 12-character password you personally invented may carry a small fraction of its theoretical bits. A 12-character string produced by a cryptographic random number generator carries essentially all of them, because there is no pattern to exploit.
Why NIST Now Recommends Length Over Complexity Rules
For years, official guidance pushed mandatory mixes of uppercase, lowercase, digits, and symbols, on the theory that a bigger character set means more entropy per character. Current NIST guidelines (Special Publication 800-63B) have moved away from that in favor of prioritizing length and screening against known-breached password lists, and the entropy math explains exactly why. Forced complexity rules push people toward predictable patterns: a capital letter first, a symbol last, a digit somewhere obvious, which is precisely what cracking tools already expect and test for first. A long passphrase built from randomly chosen words sidesteps that problem entirely, since there is no "rule" for an attacker's tool to anticipate, and the resulting phrase is realistically usable by an actual human. Our passphrase versus password guide works through this comparison directly against real cracking benchmarks.
How Much Entropy You Actually Need
- Everyday online accounts, protected by rate limiting and 2FA: around 70 bits is comfortably enough, since no attacker gets billions of live login attempts against a well-built site.
- Encryption keys, password manager master passwords, or anything an attacker could attack offline: aim higher, 80 to 100-plus bits, because an offline attacker sets their own guessing speed with no rate limit stopping them.
- Beyond roughly 100 bits: you are defending against attacks no computer on Earth could complete before the sun burns out. More entropy past that point is not wrong, just not the limiting factor in your actual security anymore.
Our password strength checker estimates real entropy and cracking time for any password you type, entirely inside your browser, and our password generator produces passwords using cryptographically secure randomness so the entropy math actually applies in full, rather than being undermined by human habits.
Frequently Asked Questions
So is "correct horse battery staple" really stronger than a short complex password?
As a category, genuinely random passphrases of 5 or more words consistently outperform short forced-complexity passwords, because length contributes more total entropy than a small character-set boost does, and the words must actually be chosen at random rather than picked because they mean something to you. A passphrase built from meaningful, guessable words loses most of that advantage.
Why does my password get marked weak even though it looks complex?
Because a good strength checker looks for patterns, dictionary words, keyboard walks, common substitutions like 0 for o, appended years, that real cracking tools try first. A password can look chaotic to a human eye and still be near the top of a cracking tool's guess list.
Does adding one symbol to my password really help much?
Barely, if it lands somewhere predictable like the very end. That single symbol adds only a few bits of entropy in theory, and cracking tools already expect a trailing symbol, so it adds close to nothing in practice. An entire additional random word typically adds around 13 bits and is far easier to remember.
How does entropy relate to the 2FA codes I generate?
The underlying TOTP secret behind your six-digit codes typically holds around 160 bits of entropy, effectively unbreakable by brute force. That is why a short, time-limited six-digit code is still safe: it is derived from an enormous, genuinely random secret, not guessed directly. Our one-time password guide covers how that derivation works, and you can generate your own TOTP codes on our homepage.
Can I skip the math and just make everything longer?
Essentially, yes, that is the practical takeaway of this entire topic. Longer plus genuinely random beats shorter plus complex, every time the math is run, and random words make length painless to remember. Understanding why is what makes the "just go longer" advice trustworthy rather than a guess.
